Changeset 1493 for trunk


Ignore:
Timestamp:
Jul 23, 2006, 5:25:49 PM (18 years ago)
Author:
nikrou
Message:

bug 451 fixed: problem with auto login

  • add an auto_login_key in users_table
  • $confsession_length is no more useful

and sessions length will be 0 (until browser closed)

Location:
trunk
Files:
1 added
5 edited

Legend:

Unmodified
Added
Removed
  • trunk/identification.php

    r1082 r1493  
    7272  }
    7373}
     74elseif (!empty($_COOKIE[$conf['remember_me_name']]))
     75{
     76  $cookie = unserialize(pwg_stripslashes($_COOKIE[$conf['remember_me_name']]));
     77  $query = '
     78SELECT auto_login_key
     79  FROM '.USERS_TABLE.'
     80  WHERE '.$conf['user_fields']['id'].' = '.$cookie['id'].'
     81;';
     82
     83  $auto_login_key = current(mysql_fetch_assoc(pwg_query($query)));
     84  if ($auto_login_key == $cookie['key'])
     85  {
     86    log_user($cookie['id'], false);
     87    redirect(empty($redirect_to) ? make_index_url() : $redirect_to);
     88  }
     89  else
     90  {
     91    // Hacking attempt!
     92    $query = '
     93UPDATE '.USERS_TABLE.'
     94  SET auto_login_key=\''.$auto_login_key.'\'
     95  WHERE '.$conf['user_fields']['id'].' = '.$user_id.'
     96;';
     97    pwg_query($query);
     98    setcookie($conf['remember_me_name'], '', 0, cookie_path());
     99    redirect(empty($redirect_to) ? make_index_url() : $redirect_to);
     100  }
     101}
    74102//----------------------------------------------------- template initialization
    75103//
  • trunk/include/config_default.inc.php

    r1470 r1493  
    313313$conf['authorize_remembering'] = true;
    314314
     315// remember_me_name: specifies the name of the cookie used to stay logged
     316$conf['remember_me_name'] = 'pwg_remember';
     317
    315318// remember_me_length : time of validity for "remember me" cookies, in
    316319// seconds.
    317320$conf['remember_me_length'] = 31536000;
    318 
    319 // session_length : time of validity for normal session, in seconds.
    320 $conf['session_length'] = 3600;
    321321
    322322// +-----------------------------------------------------------------------+
  • trunk/include/functions_session.inc.php

    r1442 r1493  
    7272    ini_set('session.use_trans_sid', intval($conf['session_use_trans_sid']));
    7373  }
    74   session_name( $conf['session_name'] );
    75   session_set_cookie_params(
    76       ini_get('session.cookie_lifetime'),
    77       cookie_path()
    78     );
     74  session_name($conf['session_name']);
     75  session_set_cookie_params(0, cookie_path());
    7976}
    8077
  • trunk/include/functions_user.inc.php

    r1462 r1493  
    552552{
    553553  global $conf;
    554   $session_length = $conf['session_length'];
     554
    555555  if ($remember_me)
    556556  {
    557     $session_length = $conf['remember_me_length'];
    558   }
    559   session_set_cookie_params($session_length);
     557    // search for an existing auto_login_key
     558    $query = '
     559SELECT auto_login_key
     560  FROM '.USERS_TABLE.'
     561  WHERE '.$conf['user_fields']['id'].' = '.$user_id.'
     562;';
     563 
     564    $auto_login_key = current(mysql_fetch_assoc(pwg_query($query)));
     565    if (empty($auto_login_key))
     566    {
     567      $auto_login_key = base64_encode(md5(uniqid(rand(), true)));
     568      $query = '
     569UPDATE '.USERS_TABLE.'
     570  SET auto_login_key=\''.$auto_login_key.'\'
     571  WHERE '.$conf['user_fields']['id'].' = '.$user_id.'
     572;';
     573      pwg_query($query);
     574    }
     575    $cookie = array('id' => $user_id, 'key' => $auto_login_key);
     576    setcookie($conf['remember_me_name'],
     577              serialize($cookie),
     578              time()+$conf['remember_me_length'],
     579              cookie_path()
     580              );
     581  }
    560582  session_start();
    561583  $_SESSION['pwg_uid'] = $user_id;
  • trunk/install/phpwebgallery_structure.sql

    r1312 r1493  
    1 -- MySQL dump 9.11
     11-- MySQL dump 9.11
    22--
    33-- Host: localhost    Database: pwg-bsf
     
    346346  `password` varchar(32) default NULL,
    347347  `mail_address` varchar(255) default NULL,
     348  `auto_login_key` varchar(64) default NULL,
    348349  PRIMARY KEY  (`id`),
    349350  UNIQUE KEY `users_ui1` (`username`)
Note: See TracChangeset for help on using the changeset viewer.